SELinux Game

Mission Briefing

A developer moved a web application to a new directory using mv instead of cp. The files kept their original security labels, and now Apache cannot serve them. You need to understand how SELinux labels work, diagnose the mislabeled files, and restore them to the correct context.

The Security Context Format

Every file, process, port, and user on an SELinux-enabled system has a security context. The context is a string with four fields separated by colons:

User is the SELinux user identity. This is not the same as a Linux user account. Common SELinux users include system_u (for system processes and files), unconfined_u (for users in the unconfined domain), and staff_u (for staff users with limited admin access).

Role determines which domains (types) a user can enter. Processes run in roles like system_r (system daemons) or unconfined_r (unrestricted users). Files always have the object_r role because files do not execute code - they are passive objects.

Type is the most important field in the targeted policy. Type enforcement is the core mechanism that controls access. When you see an AVC denial, the scontext type (the process) was denied access to the tcontext type (the resource). Almost all troubleshooting on a targeted policy system comes down to getting the types right.

Level is used by Multi-Level Security (MLS) and Multi-Category Security (MCS). On a standard targeted policy, you will usually see s0 here. MCS becomes important when you reach Level 5 and work with containers.

Inspecting Labels on Files

The -Z flag on ls shows the security context alongside the normal file listing:

These files are labeled httpd_sys_content_t, which the policy allows httpd_t (the Apache process) to read. This is how type enforcement works: the process type and the file type must match according to the policy rules.

Now compare that to files that were moved from a home directory:

These files have the user_home_t type. The httpd policy does not allow httpd_t to read user_home_t files. This is exactly the kind of problem you saw at the end of Level 1.

Inspecting Labels on Processes

Use ps -Z to see what context a running process has:

The httpd workers run as httpd_t. The targeted policy defines exactly what httpd_t can access: files labeled httpd_sys_content_t (read), httpd_sys_rw_content_t (read-write), ports in the http_port_t set, and so on.

Inspecting Your Own Context

The id -Z command shows your current security context:

If you are logged in as root on a default targeted system, you are typically in the unconfined_t domain. This means SELinux does not restrict your actions. Confined processes like httpd are the ones that get type enforcement applied to them.

How Labels Get Assigned

When a file is created, it inherits a label based on the parent directory's context and the file context rules in the policy. The command semanage fcontext -l lists all the rules:

This tells you that anything under /var/www should be labeled httpd_sys_content_t. When you use cp to copy a file into /var/www, the new file gets the correct label automatically. But when you use mv, the file keeps its original label. This is one of the most common sources of SELinux issues.

Fixing Labels with restorecon

The restorecon command resets file labels to the values defined in the policy:

The -R flag makes it recursive. The -v flag prints what it changed. For this to work, there must be a file context rule that covers the path. If your web root is at a non-standard location like /srv/webapp, you may need to add a rule first:

The semanage fcontext -a command adds a new rule. The regex pattern /srv/webapp(/.*)? matches the directory itself and everything inside it. After adding the rule, restorecon applies it.

Temporary Label Changes with chcon

The chcon command changes a file's context immediately, but the change is temporary. Running restorecon or relabeling the filesystem will overwrite it:

Use chcon for quick testing. Use semanage fcontext plus restorecon for permanent fixes. If you rely on chcon in production, a filesystem relabel will undo your work.

Key Commands Reference